SAN FRANCISCO (CN) – As it faces an onslaught of fresh criticism over its handling of private data, a federal judge urged Facebook on Thursday to look long and hard at its practice of harvesting facial data from online photos.
“With everything going on in the world, maybe it’s time for Facebook to look at all of its privacy practices and not just those in the news,” U.S. District Judge James Donato said in court Thursday after urging the social network to try settling a three-year-old privacy class action.
At a hearing on class certification and dueling summary judgment motions, Facebook argued it can’t be held liable on claims it collected users’ facial data without consent because the plaintiffs suffered no concrete harm.
The plaintiffs claim Facebook’s scanning and storing of facial data for its “Photo Tag Suggest” function violates the Illinois Biometric Information Privacy Act (BIPA), enacted in 2008. Under BIPA, companies are required to obtain consent before collecting or disclosing biometric data, such as retina scans, fingerprints, voiceprints, hand scans, or facial geometry.
“The Illinois Legislature says when they said ‘aggrieved,’ it means something more than taking biometric identifiers without notice and consent,” Facebook lawyer Laruen Goldman declared in court Thursday.
Donato appeared inclined to reject that argument, as he did last month when he ruled the unauthorized collection of biometric facial data could cause “intangible harm” by depriving people of control over their private data.
Goldman argued a recent ruling by an Illinois appeals court confirmed individuals must suffer concrete harm to seek damages for BIPA violations. In its December 2017 ruling Rosenbach v. Six Flags, the Illinois Appellate Court dismissed a suit over Six Flags scanning the thumbprint of a minor for a season pass without his parents’ permission. The court found the minor was not an “aggrieved” person as required under the law because he suffered no concrete injury.
But Donato said that ruling was “tied to the facts of the Six Flags case,” which differs from this case where the plaintiffs allege loss of control over their private data, not a mere violation of the Illinois law.
“That kind of kicks Rosenbach to the curb, doesn’t it,” Donato asked.
Facebook further contends that users agreed to be bound by its data policy, which states Facebook is “able to suggest that your friend tag you in a picture by comparing your friend’s pictures to information we’ve put together from your profile pictures and the other photos in which you’ve been tagged.”
The policy further states: “We store data for as long it is necessary to provide products and services to you and others, including those described above.”
However, the plaintiffs say Facebook never obtained a written release from users before it started harvesting their data. They claim Facebook failed to provide a retention schedule that details when it will destroy the biometric data, as required under the law.
At the end of Thursday’s hearing, Donato urged both sides to try settling the case before a jury trial kicks off July 9.
Donato said he would ask U.S. Magistrate Judge Donna Ryu in Oakland to schedule settlement conference dates within the next 30 to 60 days. Donato also ordered both sides to bring client representatives to those meetings with “full authority to settle on the spot.”
A hearing on motions to exclude expert testimony and second-phase summary judgment motions was scheduled for May 3.
Thursday’s hearing came less than two weeks after The New York Times revealed that United Kingdom-based data firm Cambridge Analytica improperly obtained the private data of 50 million Facebook users and used it to help political clients, including President Donald Trump’s 2016 campaign.
After the scandal was made public, Facebook lost more than $50 billion in market value and was hit with at least six shareholder class actions accusing the social media giant of hiding problems of protecting user data from investors.
The company has also been hit with at least eight class actions over the last nine days for failing to protect user data, and one by Android users who say Facebook collected text log and phone call data from their phones without permission.
Co-founded in 2004 by Harvard dropout Mark Zuckerberg, the Menlo Park-based social network had 1.4 billion active daily users as of December 2017 and was valued at $407.3 billion as of May 2017, according to Facebook and Forbes.
Earlier this week, Zuckerberg – currently Facebook’s CEO – agreed to testify before a U.S. Senate committee on the Cambridge Analytica data-mining scandal, but he declined to appear before a United Kingdom parliamentary committee on the use or misuse of social media to influence elections, including the 2016 Brexit vote to leave the European Union.